@zambezi/jsbin (3.40.4-ez-bin.5), pin-api (>=1.1.0, <=1.3.1) potentially affected by CVE-2019-10795 via undefsafe (>=2.0.0, <=2.0.1)

undefsafe NPM version =2.0.0, =1.1.0, =1.3.1 Source cves: CVE-2019-10795 Source advisory: SNYK:JS-UNDEFSAFE-548940...

Prototype Pollution

Overview undefsafe is a Simple function for retrieving deep object properties without getting "Cannot read property 'X' of undefined". Affected versions of this package are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype...

CVE-2019-10795: Improper Neutralization of Special Elements in Output Used by a Downstream Component

undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a proto payload...

PT-2020-9146

Name of the Vulnerable Software and Affected Versions undefsafe versions prior to 2.0.3 Description The issue allows the a function to be tricked into adding or modifying properties of Object.prototype using a proto payload, which is a type of Prototype Pollution. This occurs because the function...